This can be caused by a number of things. The the three most obvious are:
1) The delegation is not inheriting correctly down the OU structure. Inspect the permissions of an actual user account object or sub-OU in AD and make sure that the group that you are delegating to is listed correctly.
2) You did not delegate the correct permissions. For simple operations like Reset Password
, there are pre-defined ACEs in the delegation wizard. Run the delegation wizard on the appropriate OU and check the "Reset user password" option. This will simplify your direct interaction with the AD permissions to rule this out.
3) The user account that you are trying to reset might be protected from permission inheritance. This happens if they are a member of certain built-in AD groups. Inspect the user account in question and make sure that the admincount
attribute is 0. If it is 1, then it means that it is or was a member of a protected group, such as Account Operators or Backup Operators. Active Directory does not allow permissions to inherit to these accounts.
"The user inherits from Account Operators group."
Do you mean that the user that is having issues is an Account Operator? Or that the account that you are trying to reset is an Account Operator?